From Out-of-Memory to Remote Code Execution in Microsoft Edge
•
4 likes•1,367 views
The document discusses exploiting out-of-memory (OOM) exceptions in web browsers to achieve remote code execution. It begins by explaining how OOM exceptions occur in browsers and strategies for triggering them reliably. It then describes a case study of triggering controllable OOM exceptions in Microsoft Edge to corrupt memory. By breaking transaction operations on arrays during an OOM, the author was able to achieve memory corruption and potentially remote code execution on Edge.
Recommended
Recommended
More Related Content
More from PacSecJP
More from PacSecJP (20)
Recently uploaded
Recently uploaded (20)
From Out-of-Memory to Remote Code Execution in Microsoft Edge
- 4. About 360Vulcan Team ü Security Researches from Qihu 360 ü Pwn2Own Winners: ü Pwn2Own 2015 IE11 ü Pwn2Own 2016 Google Chrome, Adobe Flash ü Pwn2Own 2017 Edge, Safari, Adobe Flash, Win10, Mac OSX ü “Master of Pwn” Pwn2Own 2017
- 5. Agenda • Out-of-Memory Excep3on in Browser • From Out-of-Memory to RCE • From Out-of-Memory to ASLR bypass • Conclusion
- 8. Browser OOM Example 1 • IE 8 CA_rArray Use Aaer Free (cve-2014-1753) • Found by fuzzing function f() { var size = 0x8000000; var s = "AAAA"; while (s.length < (size - 2)/2) s += s; var x = document.createElement("frame"); x.setAttribute("prop2", s.substring(0, (size - 2)/2)); var node = document.body.appendChild(x); for ( var y = 0; y < 20; ++ y ) { var z = node.cloneNode(); document.body.appendChild(z); } }
- 10. Browser OOM Example 2 • IE Jscirpt JSON.parse OOM Memory Corrup3on var chunksize = 0x2000000; var json = '[' for ( var i = 0; i < chunksize/0x10; ++ i ) json += '1,' json += '1]'; var arr = new Array(); try { for ( var i = 0; i < 0x1000; ++ i ) arr.push(json.substr(0, (chunksize-2)/2)); } catch (e) {} // Force IE into low-memory state by allocating large amount of memory while (true) { JSON.parse(json); }
- 11. jscript!JSONParser::ParseObject+0x3fb: 65b4e9da mov eax,dword ptr [esi+14h] // length of the json array 65b4e9dd mov dword ptr [esp+14h],eax 65b4e9e1 shl eax,4 // alloc size = arr_length * 0x10 65b4e9e4 push eax 65b4e9e5 mov dword ptr [esp+20h],eax 65b4e9e9 call dword ptr [jscript!_imp__malloc (65b740fc)] // malloc can fail if there is no sufficient memory // malloc fail is not checked and will directly copy content to address [NULL + arr_size] 65b4ea2f a5 movs dword ptr es:[edi],dword ptr [esi] es:002b:00777fc0=???????? ds:002b:03eb8398=00000003
- 12. OOM Bugs – Different Types • Handled/Not Handled • Controllable/Uncontrollable • 32-bits/64-bits • Con3nuable/Not Con3nuable
- 13. Handled/Not Handled • Handled OOM – Developer is aware of poten3al OOM in the code – But failed to handle it correctly (e.g. the IE CA_rArray UAF case) • Not handled OOM – Developer has no idea about the poten3al OOM in the code (e.g. the JSON case) – Can cause unexpected execu3on path change (early return, excep3on), which can cause exploitable condi3on
- 14. Controllable/Uncontrollable • Controllable – We can trig the OOM excep3on reliably, at any 3me we want • Controllable large alloca3on • Controllable low-memory state • Uncontrollable – Occurs randomly, not controlled by us • Small alloca3ons • Uncontrollable low-memory state
- 16. Con3nuable/Not Con3nuable • Con3nuable – Program can con3nue to execute aaer the OOM – Exploit possible • Not Con3nuable – Program can not con3nue to execute aaer OOM • Crash immediately due to non-exploitable memory corrup3on (e.g. null pointer deference) • Crash ac3vely for alloca3ons that can not fail • Browser has a memory limita3on, and will crash if memory exceeds the limita3on – Not exploitable, only DDOS L
- 20. A Journey With OOM Bugs in Microsoa Edge • Find controllable OOM in Edge • Break the transac3on opera3ons to make inconsistent array state • Achieve memory corrup3on • Win
- 26. try { for (var i = 0x10000000; i < 0x18000000; ++ i) a[i] = 0x0d0d0d0d; } catch (e) {} try { while (true) { arr_ab.push(new ArrayBuffer(0x02c9dbec * 4)); // Step 1: Make browser into a low-memory state by alloca,ng large memoy } } catch (e){} try { a.reverse(); // Step 2: Trig array segment alloca,on to throw OOM excep,on } catch (e) {alert(e);} Trig OOM in 32-bits Edge - Example
- 33. Array Transac3on Opera3on • Array contains some import fields – Array: array type, length, head, cached last-used segment – Segment: lea, length, size, elements • When you change one of the fields, you must also change some others to keep the array valid – E.g. When you convert an Int array to Float array, the int elements in the segments need also be changed to floats
- 37. Let’s Party!
- 38. RCE Case: Array.unshia nElemntsToUnshiG = Number of Elements to UnshiG Foreach segment in array: segment->leG += nElemntsToUnshiG (1) SetUnshiGElementsToHeadSegment(); (2) Array->length += nElemntsToUnshiG; (3) Transac3on Opera3on of Array.unshia
- 39. nElemntsToUnshiG = Number of Elements to UnshiG Foreach segment in array: segment->leG += nElemntsToUnshiG (1) SetUnshiGElementsToHeadSegment(); (2) Array->length += nElemntsToUnshiG; (3) Break Set elements to the head segment can cause realloca%on of the head segment, which can throw Out-of-Memory excep%on
- 42. RCE Case: Array.unshia • A heap overflow in array segment is quite simple to exploit • Just allocate another array segment aaer the overflowed segment, then we can overwrite the length and size filed of next segment lea length size Overflow 0xffffffff 0xffffffff Overflowed Segment Next Segment
- 44. RCE Case: JavascriptNa3veIntArray::ToNa3veFloatArray • This func3on converts an int array to float array Foreach segment in array: seg->size >>= 1 (1) if (seg->length > (seg->size >>= 1)) seg = AllocateNewSegment (2) Seg->ChangeElementToFloat() (3) Adjust(seg->length) (4) Transac3on Opera3on of JavascriptNa3veIntArray::ToNa3veFloatArray
- 45. Foreach segment in array: seg->size >>= 1 (1) if (seg->length > (seg->size >>= 1)) seg = AllocateNewSegment (2) Seg->ChangeElementToFloat() (3) Adjust(seg->length) (4) Break Allocate a new array segment can throw Out-of-Memory excep%on. At this point, seg->size has been diveded by 2, while seg->length remains unchanged.
- 46. • By breaking the ToNa3veFloatArray transac3on opera3on – We can have an array segment that Seg->length > Seg->size • Get RCE exactly the same way as Array.unshia – One of the backup bugs for Pwn2Own 2017 – We prepared several similar bugs as backups (e.g. Array.splice) RCE Case: JavascriptNa3veIntArray::ToNa3veFloatArray
- 47. Patch Time – April Fix • Microsoa fixed our Pwn2Own bug in April • The fix is a li_le surprise – It does not fix the OOM excep3ons – Instead it tries to break the exploit tech we used • Added a new func3on “CheckLengthVsSize” • To avoid heap overflows caused by “segment->length > segment->size”
- 49. Problem of The April Fix • It breaks some OOM exploits in our hand • But the root cause s3ll not fixed – Root cause: OOM excep3on breaks array transac3on opera3on • And there are other OOM vulnerabili3es that do not require “seg->length > seg->size” to exploit
- 51. RCE Case: Array.reverse Segment Use Aaer Free Reverse the whole segment list (1) If head is leaf segment: head = ReallocateNonLeafSegment (2) Transac3on Opera3on of Array.reverse
- 52. Leaf Segment • Leaf segment – Pure data segment – Next Segment will NOT be scanned when GC • Non leaf segment – Next Segment will be scanned when GC Non Leaf Non Leaf Leaf Leaf Non Leaf Non Leaf ü X The last 2 segments will not be scanned by GC and will be freed unexpectedly, causing use aaer free
- 53. RCE Case: Array.reverse Segment Use Aaer Free Non Leaf Step 1: Reverse the segment list Step 2: Reallocate head if it’s leaf segment Non Leaf Leaf Leaf Non Leaf Non Leaf Non Leaf Non Leaf Non Leaf Break Reallocate non leaf segment may cause out-of-memory excep%on
- 56. RCE Case: ConvertToVarArray Buffer Overflow • JavascriptNa3veFloatArray::ConvertToVarArra y buffer overflow Foreach segment in array: if seg is leaf segment: seg = ReallocateNonLeafSegment() (1) seg->size *= 2 (2) seg>ChangeIntElementsToVar() (3) Array->ChangeTypeToVarArray() (4)
- 57. Seg->size *= 2 ? • In 32-bits edge, sizeof(Var) = 4, sizeof(Float) = 8 • So when conver3ng float segment to var segment, we can double the capacity (size) of the segment Float Float var var var var
- 58. Foreach segment in array: if seg is leaf segment: seg = ReallocateNonLeafSegment() (1) seg->size *= 2 (2) seg>ChangeIntElementsToVar() (3) Array->ChangeTypeToVarArray() (4) Break Reallocate non leaf segment may cause out-of-memory Excep%on. If we break at (1) in the middle of the itera%on, some segments’ size will already be doubled, and the doubled size will not be restored.
- 61. AutoDisableInterrupt • A class for protec3ng a region of code • Crashes the process if the protected code region throws any excep3on • Solved the root cause – Added to many import func3ons such as unshia, splice, array conversions, … – Maybe forget some func3on?
- 62. RCE Case: Array.reverse (Again) • Aaer the AutoDisableInterrupt patch – Array.reverse is not protected by it • CVE-2017-8619 fixed the OOM segment UAF issue we reported • Then we found another OOM issue in the same func3on – CVE-2017-8753 – Type confusion caused by invalid lastUsedSegment
- 64. RCE Case: Array.reverse (Again) lastUsedSegment = head; (1) head = AllocateNewHead(); (2) If the last segment is leaf: ReallocateLastSegmentToNonLeaf(); (3) lastUsedSegment = head; (4) Break Reallocate non leaf segment may cause out-of-memory Excep%on. If we break at (3), the array will have a lastUsedSegment points to an invalidated segment
- 66. And It Con3nuous … • CVE-2017-8753 fixed in September • End of OOM exploit in edge ? • Let’s check it out J • Demo 3me, maybe
- 71. What Does That Mean • When we allocate a 64 KB fast array buffer, the real commi_ed memory is 64 KB • But edge will reserve 4GB virtual memory space for it • So we can occupy 4GB memory by just commi•ng 64 KB memory
- 73. User Mode Memory Space in 64-bits Edge • Windows 10 uses 48-bits for user mode memory • User heap address will be always less than 0x800000000000 • So we only need to spray less than 0x8000 array buffers to exhaust user mode memory space
- 74. 5 Lines to Exhaust Memory in 64-bits Edge var arr = new Array(0x10000 / 2); try { for (i = 0; i < arr.length; i ++ ) arr[i] = new ArrayBuffer(0x10000); } catch (e) { // out of memory excep3on}
- 78. Demo
- 80. Limita3on • It takes too long to finish the spray – ~300 seconds on my laptop • Not suitable for real a_ack • Nice op3on to be used in contests such as Pwn2OwnJ
- 82. Conclusion • Out-of-Memory excep3ons in browsers are oaen ignored by developers/bug hunters • It is s3ll possible to find exploitable if we focus on controllable ones in modern browser • We s3ll need to take OOM issues seriously
- 83. Thank you!